EUVD-2026-19943Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Unauthenticated network listener (AV:N/AC:L/PR:N/UI:N); availability is high (host freeze) but disclosure is limited to paths/usernames, so C:L rather than C:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
13DescriptionNVD
Podman Desktop is a graphical tool for developing on containers and Kubernetes. Prior to 1.26.2, an unauthenticated HTTP server exposed by Podman Desktop allows any network attacker to remotely trigger denial-of-service conditions and extract sensitive information. By abusing missing connection limits and timeouts, an attacker can exhaust file descriptors and kernel memory, leading to application crash or full host freeze. Additionally, verbose error responses disclose internal paths and system details (including usernames on Windows), aiding further exploitation. The issue requires no authentication or user interaction and is exploitable over the network. This vulnerability is fixed in 1.26.2.
AnalysisAI
Denial-of-service and information disclosure in Podman Desktop prior to 1.26.2 stem from an unauthenticated HTTP server that any network attacker can reach without credentials or user interaction. By abusing missing connection limits and timeouts, an attacker exhausts file descriptors and kernel memory to crash the application or freeze the entire host, while verbose error responses leak internal filesystem paths and system details (including Windows usernames). SSVC marks exploitation as proof-of-concept and automatable; publicly available exploit code exists, but EPSS probability is low (0.06%, 19th percentile).
Technical ContextAI
Podman Desktop (CPE cpe:2.3:a:linuxfoundation:podman_desktop) is a cross-platform graphical front end for managing Podman containers and Kubernetes, used on developer workstations across Windows, macOS, and Linux. The flaw maps to CWE-209 (Generation of Error Message Containing Sensitive Information): the application's locally-exposed HTTP server returns verbose diagnostic errors that reveal internal paths and OS account names. Compounding this, the same listener enforces no connection limits or timeouts, so resource-exhaustion (file descriptor and kernel memory consumption) is possible against the host. Because the server is bound in a way reachable by network peers rather than restricted to loopback, untrusted parties on the same network can interact with it directly.
RemediationAI
Upgrade to Podman Desktop 1.26.2 or later, which fixes the issue (Vendor-released patch: 1.26.2). Consult the GitHub advisory at https://github.com/podman-desktop/podman-desktop/security/advisories/GHSA-2q88-39rh-gxvv and the Red Hat erratum RHSA-2026:13867 (https://access.redhat.com/errata/RHSA-2026:13867). Until patched, restrict network exposure of the embedded HTTP listener: use a host firewall to block inbound connections to its port from all non-loopback sources, and avoid running Podman Desktop on untrusted or shared networks (e.g., public Wi-Fi) where adjacent hosts could reach it - the trade-off is none for single-developer local use since the server is only needed locally. On Windows, be aware that verbose errors can expose the account username, so treat affected workstations as higher priority. These controls reduce the attack surface but the definitive remediation remains the 1.26.2 upgrade.
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today